File Recovery

Active@ File Recovery
User Guide
1 Active@ File Recovery Guide

Copyright 1999-2016, LSOFT TECHNOLOGIES INC. All rights reserved. No part of this documentation
may be reproduced in any form or by any means or used to make any derivative work (such as translation,
transformation, or adaptation) without written permission from LSOFT TECHNOLOGIES INC.
LSOFT TECHNOLOGIES INC. reserves the right to revise this documentation and to make changes in
content from time to time without obligation on the part of LSOFT TECHNOLOGIES INC. to provide
notification of such revision or change.
LSOFT TECHNOLOGIES INC. provides this documentation without warranty of any kind, either implied or
expressed, including, but not limited to, the implied warranties of merchantability and fitness for a
particular purpose. LSOFT may make improvements or changes in the product(s) and/or the program(s)
described in this documentation at any time.
All technical data and computer software is commercial in nature and developed solely at private expense.
As the User, or Installer/Administrator of this software, you agree not to remove or deface any portion of
any legend provided on any licensed program or documentation contained in, or delivered to you in
conjunction with, this User Guide.
Active@ File Recovery, the Active@ File Recovery logo, File Recovery Software are trademarks of LSOFT
TECHNOLOGIES INC.
Active Data Recovery Services is a business name of LSOFT TECHNOLOGIES INC.
LSOFT.NET logo is a trademark of LSOFT TECHNOLOGIES INC.
Other brand and product names may be registered trademarks or trademarks of their respective holders.
Active@ File Recovery Guide 2

Contents
Overview ..................................................................................................................................... 4
Using QuickScan to scan volume for deleted files....................................................................... 12
Use SuperScan to analyze deleted and damaged volumes ......................................................... 14
Use Last Chance recovery by file signatures .............................................................................. 20
Search for Deleted Files and Folders .......................................................................................... 22
Preview File Contents (Recovery Status Check).......................................................................... 25
Restore a Deleted File ............................................................................................................... 26
Restore a Deleted Folder ........................................................................................................... 28
Virtually Reassemble Deleted or Damaged RAID ........................................................................ 30
Open and work with Disk Image................................................................................................ 33
Create a Disk Image .................................................................................................................. 35
Search for File Signatures and Define Custom Signatures .......................................................... 37
Inspect file headers and disk data (raw sectors) with integrated Disk Editor (HEX Viewer) ......... 45
Concept of File Signatures ......................................................................................................... 48
Recovery Tips............................................................................................................................ 50
Frequently Asked Questions (FAQ) ............................................................................................ 51
Glossary of Terms ..................................................................................................................... 52

Overview
What Happened to my Data?
When a file is written to a hard drive, two separate systems come into play:
1. A record of the file is kept in the Root Table or Master File Table (MFT).
2. Data is written to physical hard drive addresses. The physical addresses are labeled as 'occupied'. These addresses are
called clusters.
When file is deleted from a hard drive, the same two systems are notified:
1. The file record in the Root Table or MFT indicates the file has been deleted.
2. Clusters are labeled as 'unoccupied'. The data is not removed.
In the event of an accidental file deletion we strongly recommend that you perform the recovery operation as soon as possible.
If any new files are written to the same drive, there is a chance that the file-writing process may allocate data to these clusters.
Welcome to Active@ File Recovery

Active@ File Recovery is a powerful software utility, designed to restore accidentally deleted files and directories. It allows you
to recover files that have been deleted from the Recycle Bin, as well as those deleted after avoiding the Recycle Bin
(e.g. Shift-Delete).
Active@ File Recovery can be installed on and run from CD/DVD or USB disk, so that the risk of overwriting your data is
minimized.
Active@ File Recovery will help you to restore data residing on hard drives, floppy or USB drives formatted in any of the
following file systems:
Microsoft NTFS / ReFS / FAT / exFAT

Apple HFS+
Linux Ext2 / Ext3 / Ext4 / BtrFS
Unix UFS, Silicon Graphics XFS, IBM JFS
CD/DVD/Blu-ray, UDF & ISO9660
It works under all Windows family operating systems:
Windows XP
Windows Vista
Windows Server 2000, 2003, 2008, 2008 R2, 2012
Windows 7, Windows 8, Windows 10
Windows PE (embedded Windows environment loaded from CD-ROM or USB disk)
Active@ File Recovery supports:
IDE, SATA, eSATA, SAS, SSD, SCSI hard drives, USB Flash disks and Memory Cards
Damaged or deleted RAID virtual reconstruction (RAID-0, RAID-1, RAID-5, Span)
Large-sized drives (more than 2TB)
Long file names and local language (non-English) file names
Recovery of compressed, fragmented and encrypted files on NTFS
Detection and recovery from deleted or damaged partitions
Saving scan results to the storage and opening them later on
Deleted files filtering, exact or partial file name search
Disk Image creation and loading (to restore files and folders from)
Search deleted files by predefined signatures, including custom signature definition
Integration with a Disk Viewer/Editor - to be able to inspect raw disk/partition/file data
RAID-5 of different types is being supported:
Left Asynchronous (the most frequently used in hardware RAIDs)

Left Synchronous (used in the most software RAIDs based on LDM)

Right Synchronous
Right Asynchronous
Active@ Scan technology allows you to recognize files based on file signatures for the following file types:
Adobe Files
Adobe Actobat Document (*.pdf)

Adobe Photoshop Document (*.psd)
Adobe Shockwave Flash File (*.swf)
Adobe Effects Projects (*.aep)
Adobe Illustrator (*.ai)
Camera Raw Files
Canon Raw CIFF Image File (*.crw)

Canon Raw Image File (*.cr2)
Digital Negative Image File (*.dng)
Fuji FinePix Raw Image File (*.raf)
Hasselblad 3F Raw Image File (*.3fr)
Kodak Photo-Enhancer File (*.kdc)
Kodak Raw Image File (*.der)
Konica Minolta Raw Image File (*.mrw)
Leaf Aptus Raw Image File (*.mos)
Leica Raw Image File (*.raw)
Mamiya Raw Image File (*.mef)
Nikon Raw Image File (*.nef)
Olympus Raw Image File (*.orf)
Panasonic LX3/LX5 Raw Image File (*.rw2)
Pentax Raw Image File (*.pef)
Samsung Raw Image File (*.srw)
Seiko Epson Raw Image File (*.erf)
Sigma Raw Image File (*.x3f)
Sony Digital Camera Raw Image File (*.arw)
Sony SR2 Raw Image File (*.sr2)
Sony SRF Raw Image File (*.srf)
Compressed Archives
7-Zip File Archive (*.7z)

ARC File Archive (*.arc)
ARJ File Archive (*.arj)
BZ2 Compressed Archive (*.bz2)
LZ4 Compressed Archive (*.lz4)
XZ Compressed Archive (*.xz)
GNU Zipped File Archive (*.gz)
LZH File Archive (*.lzh)
TAR Archive File (*.tar)
Windows Cabinet Archive File (*.cab)
RAR Archive File (*.rar)
Zipped File Archive (*.zip)
ZOO File Archive (*.zoo)
Electronic Books
DjVu eBook Image File (*.djvu)

Fiction Book 2.0 File (*.fb2)
Microsoft eBook Format (*.lit)
Rocket eBook File (*.rb)
File System Metadata
CDFS Disk Image File (*.iso)

FAT Directory Record (*.$dir)
NTFS File Record (*.$file)
NTFS Index Record (*.$indx)
FileMaker Platform
FileMaker Pro 3.0 File (*.fp3)

FileMaker Pro Database (*.fp5)
File Maker Pro Document (*.fmp12)
File Maker Pro Ver.7 + Database (*.fp7)
Formatted Text Files
Compiled HTML Help File (*.chm)

Extensible Markup Language Document (*.xml)
Hypertext Markup File (*.htm)
Rich Text Format File (*.rtf)
Microsoft Office & OpenOffice Documents
Crystal Report (*.rpt)

Microsoft Access 2007 Database (*.accdb)
Microsoft Access Database (*.mdb)
Microsoft Exel Open XML Document (*.xlsx)
Microsoft Exel Spreadsheet (*.xls)
Microsoft Outlook Message (*.msg)
Microsoft Word Document (*.doc)
Microsoft Word Open XML Document (*.docx)
OpenDocument Text Document (*.odt)
Other OLE-container (*.ole)
Outlook Offline Folder Files (*.ost)
Outlook Personal Information Store (*.pst)
PowerPoint Open XML Presentation (*.pptx)
PowerPoint Presentation (*.ppt)
Visio Drawing File (*.vsd)
XML Paper Specification File (*.xps)
OpenOffice Text Document (*.odt)
OpenOffice Spreadsheet (*.ods)
OpenOffice Database (*.odb)
OpenOffice Formula (*.odf)
OpenOffice Graphic (*.odg)
OpenOffice Presentation (*.odp)
Music & Audio Files
4X Technologies Audio File (*.4xa)

Advanced Audio Coding File (*.aac)
Audio Codec 3 File (*.ac3)

Audio Interchange File (*.aiff)
Compressed Audio Interchange File (*.aifc)
Free Lossless Audio Codec File (*.flac)
MIDI File (*.mid)
Monkey's Lossless Audio Codec File (*.ape)
MP3 Audio File (*.mp3)
Ogg Vorbis Compressed Audio File (*.ogg)
Rich Music Format File (*.ra)
Simple Audio File (*.au)
Synthetic Music Mobile File (*.mmf)
WAVE Audio File (*.wav)
WavPack Correction Audio Stream (*.mvc)
Windows Media Audio File (*.wma)
Photos & Images
Bitmap Image File (*.bmp)

Corel Metafile Exchange Image (*.cmx)
Corel Draw Image File (*.cdr)
Graphical Interchange Format File (*.gif)
Icon File (*.ico)
JPEG Image File (*.jpg)
JPEG 2000 Core Image File (*.jp2)
JPEG 2000 Image File (*.j2c)
Maxon Cinema 4D (*.c4d)Multiple-image Network Graphics (*.mng)
Paintbrush Bitmap Image File (*.pcx)
Portable Network Graphics (*.png)
Scalable Vector Graphics File (*.svg)
Tagged Image File (*.tif)
Windows Animated Cursor (*.ani)
QuickTime Multimedia
3G2 Multimedia File (*.3g2)

3GP Multimedia File (*.3gp)
CDC Multimedia File (*.cdc)
DRM Multimedia File (*.dcf)
F4V Multimedia File (*.f4v)
JPA Multimedia File (*.jpa)
JPM Multimedia File (*.jpm)
JPX Multimedia File (*.jpx)
M4A Multimedia File (*.m4a)
M4B Multimedia File (*.m4b)
M4V Multimedia File (*.m4v)
MAF Multimedia File (*.maf)
Motion JPEG 2000 Video Clip (*.mj2)
MOV Multimedia File (*.mov)
MP4 Multimedia File (*.mp4)
MPG Multimedia File (*.mpg)
MQV Multimedia File (*.mqv)
SDV Multimedia File (*.sdv)
Video Files
4X Technologies Media File (*.4xm)

Advanced Systems Format File (*.asf)
Anime Music Video File (*.amv)

Audio Video Interleave File (*.avi)
Autodesk Animation File (*.fli)
Autodesk Animation Pro File (*.flc)
Flash Video File (*.flv)
FlashBack Screen Recording File (*.fbr)
Material Exchange Format File (*.mxf)
Matroska Video File (*.mkv)
MPEG (RIFF) File (*.mpg)
MPEG Transport Stream (*.mts)
MPEG Video File (*.mpeg)
MPEG2 Video File (*.m2v)
Red Core Digital Cinema Camera (*.r3d)
Red Media Format File (*.rm)
Windows Media Video File (*.wmv)
Red Media Format File (VBR)(*.rmvb)
Miscellaneous Files
3D Studio Max Model File (*.max)

Autodesk 3DS file (*.3ds)
Drawing Exchange Format File (*.dxf)
Encapsulated PostScript File (*.eps)
QuickBooks Data File (*.qbw)
3D Systems StereoLithography (*.stl)
FireBird Database File (*.fdb)
AutoCAD Drawing Database (*.dwg)
SQLite Database File (*.db3)
Visual Studio Project File (*.vcproj)
Visual Studio User Options (*.user)
Custom file signatures can be defined via user templates placed into and loaded from text files. After you recover files by
signatures, you can use Organizer to organize them in folders with readable (non-abstract) names.
The free evaluation version has full functionality of all features with a limitation only on maximum size of the file being restored.
New in version 16
More pre-defined file signatures recognition: AI, ACCDB, OST, DB3, VCPROJ, USER, SVG, FBR
Support for Microsoft's new generation ReFS file system scan & data recovery
Support for Linux/Unix JFS file system scan & data recovery
Recovery of fragmented files by signatures (MOV/MP4)

Redesigned User Interface: dockable dialogs, semi-transparent popups
Full support for HiDPI monitors (large screen resolutions)
Improvements in XFS / Ext4 filesystems recovery
New security based on software registration and activation
New in version 15
More pre-defined file signatures recognition: AC3, MSG, 3DS, MAX, DXF, CMX, AMV, 4XM, 4XA, EPS, XZ, LZ4, BZ2,
JP2, M2V, MTS, FDB
File systems metadata display: $FILE & $INDX file records for NTFS, $DIR Directory entries for FAT/FAT32
Support for Linux/Unix XFS file system scan & data recovery

Support for Linux Logical Volume Manager (LVM) partitioning and recovery
Improved Windows Logical Disk Manager (LDM) support for nested volumes
Improved display for HiDPI monitors and large resolution screens

Improvements in user interface and in data recovery algorithms
The latest Active@ Boot Disk (64-bit) and improved Boot Disk Creator
The latest Active@ LiveCD (64-bit) with updated drivers and new utilities
New in version 14
Added more pre-defined file signatures recognition: 3D Systems STL, Adobe AEP, ISO, AutoCAD DWG, Maxon C4D,
OpenOffice Spreadsheet ODS, Database ODB, Formula ODF, Graphic ODG and Presentation ODP
Added option to skip sectors while scanning in case if bad sectors detected
Improved recovery of files just deleted, based on NTFS Log (Journal)

Improved Linux Ext2\Ext3\Ext4 file systems scanning performance
Included the latest Active@ Disk Editor 6, being able to browse disks and preview files
Minor improvements in user interface and in recovery algorithms

Active@ Boot Disk switched to WinPE 5.1 64-bit (x64) architecture which performs faster & optimizes RAM usage
Active@ Boot Disk now being able to boot the latest UEFI Secure Boot systems
New in version 13
Added "Last Chance" recovery method for detecting files by signatures
Added recovery of files from Linux BtrFS file system
Added recovery of 26 more pre-defined file signatures: eBooks, Adobe Flash, Real Audio, Archives: MXF, MKV, GIF,
LIT, RMF, WVC, OGG, RB, ARC, AIF, FB2, PSD, AU, 7Z, FLIC, FLAC, APE, MEF, AAC, ZOO, TAR, PCX, F4V, FLV, MMF,
SRW)
Improved processing of internal attributes for signatures: MID, MRW, RAF, X3F, PDF, RA, RM, RMVB
Ultimate package now includes linux-based bootable Active@ LiveCD, being able to boot all the latest UEFI secure boot
systems
New in version 12
Added 64-bit executable which scans disks much faster and optimizes memory usage on x64 platforms
Files detected by Signatures can be organized (sorted, viewed and placed in folders) by attributes before recovery
Added Virtual Disk option, to scan devices/disk images having different sector size
Increased memory limits (up to 3GB) for 32-bit executable to process larger data arrays on x86 platforms
Minor improvements in disk scan and recovery algorithms
New in version 11
New Look and Feel: light color scheme by default
Improved integrated Disk Editor (HexViewer), including Linux & Unix iNode & SuperBlock templates
Custom file signatures can be defined via powerful scripting language
Display of file meta-data (title, date) for files detected by signatures
Sorting & recovery based on file meta-data (title, date) for files detected by signatures
Added new built-in signatures for file types: 3FR, RW2, ERF, KDC, DCR, MOS, ODT, OLE and XPS
Fixed minor bugs and improved scanning and recovery algorithms

New in version 10
Support for recovery from FreeBSD UNIX UFS and Linux Ext4fs file systems
Added an integrated Disk Editor (HEX Viewer) component being able to inspect disks and files on a low level (raw
sectors)
Flexible application style: can be changed from Dark to Light color schemas
Convenient 'Go Back' and 'Go Up' navigation buttons and key combinations added
Custom file signatures can be defined via user templates loaded from a text file
Added RAR archive signature to the internally supported Signatures List
Improvements in recovery kernel: faster scans, more files and partitions can be detected...
New in version 9.5

Support for Apple HFS+ and Linux Ext2/Ext3/Ext4fs file systems recovery
Docked Properties window displays objects properties on-the-fly (dynamically changing context)
Added search by objects ID range, and full objects path is now displayed
Stores settings in INI file instead of Registry
Improved recovery files of MP3 type by signatures
File Preview allows to preview files up to 10MB in size, more shortcuts added
Improved software RAIDs (based on LDM) handling and re-construction
New in version 9.0

Support for exFAT file system recovery
Support for 4096 byte sector size HDDs
Support for RAW-Compressed images and RAW images manually composed from several chunks
Support for VMWARE & VirtualPC HDD images: open and work as with regular HDDs
New Signature files supported (Adobe *.pdf, Flash *.swf, DJVU *.djvu, QuickTime *.m4)
Support for multi-tasking: user can QuickScan found volumes and recover data while SuperScan is in progress
SuperScan progress: displays of map of scanned sectors and found meta-data while scanning
Configuration parameters stored locally and re-loaded upon next use
Improved SuperScan algorithms detects more deleted partitions and reveals more files for recovery
Scan speed increased 2 to 4 times, with significant reduction in system memory consumption
Keyboard shortcuts added many operations can be performed without use of a mouse
Integrated Active@ Organizer utility
Search results displayed with full path and supports hierarchical structure
SuperScan process displays many details, including sector info, time elapsed and time remaining, displays found meta-
data
Advanced filtering of volumes found by SuperScan
Full support for multi-language character sets (Unicode), recovers files and folders having names containing non-
English characters (ex. Spanish, Chinese, Korean, etc.)
New in version 8.0

Fixed bug caused exception on hard disks > 2TB
Improved FAT partitions search
New improved Boot Disk Creator
Enterprise version now contains full installation bootable ISO (no additional download required)
Windows PE updated to version 3.0 (based on Windows 7)
Fixed minor bugs
New in version 7.3

RAID-5 of different types is being supported:

Left Asynchronous (the most frequently used)
Left Synchronous
Right Synchronous
Right Asynchronous
Important
PROTECT THE DRIVE LOCATION WHERE YOU HAVE ACCIDENTALLY DELETED FILES.
Any program that writes data to the disk, even the installation of data recovery software can spoil your sensitive data.
DO NOT RECOVER DATA ONTO THE SAME DRIVE THAT YOU FOUND ERASED DATA!
While saving recovered data onto the same drive where sensitive data was located, you can spoil the process of recovering by
overwriting table records for this and other deleted entries. It is better to save data onto another logical, removable, network or
floppy drive.
IF YOU HAVE AN EXTRA HARD DRIVE, OR OTHER LOGICAL DRIVES THAT ARE BIG ENOUGH, CREATE A DISK IMAGE.
A Disk Image is a single-file mirror copy of the contents of your logical drive. Backing up the contents of the whole drive -
including deleted data - is a good safety precaution in case of failed recovery. Before you start recovering deleted files, create a
Disk Image for this drive.

Use QuickScan to scan volume for deleted files
QuickScan searches existing partitions (volumes) for deleted or damaged files or folders. Before you begin to search for files and
folders or recover data, you must scan the drive.
There are two methods for scanning:
QuickScan is a fast and basic scan. Most deleted files and folders can be found using this method.
SuperScan is a much slower and thorough scan. It processes the whole hard drive surface detecting all
possible deleted data. If, after running QuickScan you did not find your deleted files, try SuperScan. For more information on
SuperScan, click the link at the bottom of this topic.
To run QuickScan, open Active@ File Recovery and do the following:
In the Local System Devices list, select the drive you want to inspect for deleted files and folders.
Click QuickScan button on the toolbar
Or, right-click the drive and select QuickScan from the context menu
Or, double-click the drive to start scanning
Or, press [ENTER] to start QuickScan using keyboard.
Disk scanning starts. To cancel the scanning process for any reason, click Stop button on a progress window.
After QuickScan is completed, you can inspect detected files and volumes, and recover your data.
To locate your deleted files and folders, you may search either manually, by opening folders in the tree, or automatically, using
the search mode.
QuickScan Plus
QuickScan Plus is an advanced version of QuickScan. It processes more unallocated space where deleted data assumed to be
located, so it is a bit slower than QuickScan, however it detects more deleted files and folders. QuickScan Plus is still faster
comparing to SuperScan (which processed all available disk space: unallocated and currently allocated).
After the regular QuickScan for the particular volume completed, toolbar button label and related menu items change to
QuickScan Plus. This means that if you scan the same object one more time, some advanced features of QuickScan will be
activated. It will take a bit more time, however it could detect more deleted files and folders. Advanced features include looking
for files beyond the "live" system areas (current MFT area on NTFS, or directories tree on FAT). Moreover, for transactional file
systems, like NTFS, Log File ($LogFile) and User Journal ($UsnJrnl$) are processed to get more information about recent
transactions (deleting, renaming,...). This could be very useful when you quick-formatted your hard drive or USB flash disk.

To change default action for QuickScan button and menu item to use QuickScan Plus always, open Settings, and on the
General tab mark Use QuickScan Plus by default option:
Analyzing detected by QuickScan objects

You can tell the state of your files by the color of the icons:
Blue icon shows an existing file
Grey icon shows a deleted file
You can tell the state of your folders by the color of the icons:
Yellow icon shows an existing folder

Grey icon shows a deleted folder
You can inspect the content of the file by selecting the file and clicking Preview toolbar button, or executing Preview
command from the context menu, or by pressing Alt+P key combination.
If you are looking for deleted files and folders, to locate them, you may search either manually, by opening folders in the tree,
or automatically, using the search mode.
If you satisfied with results, select an object (file, folder or partition) proceed with a recovery (click Recover toolbar button).

Use SuperScan to analyze deleted and damaged
volumes
Use SuperScan when trying to recover a partition or volume that you know has been deleted or damaged. In other words, if
you do not see a logical drive listed under a device node in the Local System Devices list, it is time to use SuperScan.
Another reason to use SuperScan is when the volume has been quick-formatted, or disk's surface has been heavily overwritten
by other data, so you are not able to find your deleted data using QuickScan and Search procedures. SuperScan gives a chance
to detect damaged file records as well as to reconstruct some known file types by signatures.
SuperScan processes the whole surface of the physical device searching for all possible logical drives (volumes) and partitions,
whether they existing, damaged or deleted. If a partition cannot be found, SuperScan keeps searching. SuperScan reads
each disk sector and looks for not only the boot sector, but also tries to reconstruct the drive structure, based on residual clues
to the drive's system structures that remain on the disk surface. This is a time-consuming process, however it usually gives
much better results than QuickScan.
When SuperScan finds file data and the deleted or damaged file is not fragmented, the SuperScan can detect files by
matching template patterns to the found data. These files collected to Signature Files folder and can be recovered from there.
Usually such files do not have name, date stamp and other file record information.
To run SuperScan:
1. In the Local System Devices list, select a physical device, or a volume that contains your data. It may be a Fixed
Disk, USB external or Removable Disk, Memory Card, and even Floppy and CD/DVD-ROM
2. To open the SuperScan Options dialog, do one of the following:
Click SuperScan toolbar button:
Right-click the disk and choose SuperScan... from the context menu
Press Ctrl+Enter key combination

3. In the Analyze and detect deleted or damaged partitions area, select the check boxes next to the partition types
that you want to look for. Clear the check boxes next to the partitions that you do not want to look for. If you select
all partition types, the scanning takes a longer time, however you may find more recoverable partitionsAll disk
surface will be scanned by default (Scan All Disk option). This is a time consuming process. In case if you know for
sure the area that needs to be scanned, click Scan Area option and define scan parameters manually:
Fields From and Size contain currently selected object's geometry in sectors. You can switch geometry
display to other units (Bytes, MB and GB) using drop down combo-box. If you click Scan now - this area will
be scanned by default
To select disk's area manually, type the starting sector number in the From field and the number of sectors
in the Size field. If you need several areas to be scanned, define area parameters and click Add button, then
type other area parameters and click Add again
4. If a disk has been severely damaged and partitions and files are not found, you may use the Signatures
Recognition option. Provided that the files are not fragmented, Active@ Scan technology would detect the file
signatures and would try to reconstruct files of certain types. The detected files, when this option is turned on, will
be placed into the Signature Files virtual folder and will have abstract filenames (because no file header could be
detected, only file data), however their content can be valid. You may try to recover your documents or images from
the Signature Files virtual folder later on. The None option means that no signatures recognition will be applied, it
will speed up the SuperScan process, and less memory (RAM) will be consumed. The All Signatures option
instructs SuperScan to recognize all possible supported signatures. The Documents & Photos only option lets you
recover specific file types, and Select Signatures let you choose the file particular types you want to recognize
based on signatures (including user-defined signatures being loaded from template file) and recover them later on:

5. Click Scan or press Enter to start SuperScan process
6. The statistics and progress bar appear underneath the scanning area. To stop the SuperScan at anytime,
click Pause red button at bottom, or choose Pause SuperScan from the context menu. If SuperScan has been
paused, you may resume it by clicking Resume button at bottom or by choosing Resume SuperScan from the
context menu. If you have saved paused SuperScan results, its state being saved as well, so you can resume
SuperScan later on, after loading SuperScan results - even after re-boot, or on another machine having the same
HDD/USB disk attached
7. For each SuperScan process a new virtual folder named SuperScan [YYYY-MM-DD HH:MM:SS] has been added to
the Local System Devices list. The contents of this folder displayed in the tree (left panel) as well as in the
Volumes tab (right panel). You may treat SuperScan virtual folder and its contents the same way that you treat other
device nodes in the list. You may follow the same steps to scan found volumes, then search for files and folders to
be recovered

Inspecting SuperScan results
SuperScan can be a long process. You can check the estimated run time displayed on the status panel at bottom of the
Scanning Area. You can wait until SuperScan finishes, or you can inspect and manage found partitions (volumes) "on-the-fly":
Click the volume in the tree (left panel) to highlight the volume position in the Scanning Area (right panel)
Right-click the volume and choose Properties from the context menu - to check volume integrity and attributes being
detected
Double-click the volume, or choose QuickScan from the context menu - to scan the volume, browse its folders, view files
and so on
You can preview and recover your files from the found volume while SuperScan is still in progress
After you have inspected the volume, if results are not satisfactory, you can hide the volume, by choosing Remove from
the context menu
To unhide all volumes being removed previously from the list, choose Show All Volumes from SuperScan node context
menu
Note
After you run a SuperScan, you may notice a tab named Signature Files. This virtual folder contains file data that was
detected based on templates of commonly used file types (*.JPG, *.DOC, etc...). Files in this folder have been renamed because
no file header was detected. If the file data is un-fragmented, there is a good chance that SuperScan recovers the data in these
files. If you haven't found your files during volumes inspection, try to recover similar file types from Signature Files folder. There
could be a chance you find your data even if file record containing file name has been overwritten.
Important
After you complete a SuperScan, you may find hundreds of partitions. Volumes having different locations and sizes, may have
been created and then deleted at different times on the device being scanned. If you have virtual VMware workstation profiles
(from VMware, Inc.) or VirtualPC profiles (from Microsoft Corp.), these files also contain partition information. Moreover, if
remainings of damaged disk structures not enough to define all necessary partition parameters, SuperScan uses complex
algorithms to project the most probable parameters and instead of one partition could create 10-20 partitions having different
sizes, offsets, cluster size and so on. This does not mean that SuperScan creates a lot of garbage. This means that among these
projected partitions most likely will be the one you've lost, and most likely you'll be able to find and recover your data. So, if you
cannot find your data on the volumes having Excellent or Good recovery status, it is still recommended that you wait until
SuperScan finishes and then inspect all found volumes once again.
Filtering SuperScan results
To reduce the amount of work, you may use a filter so that you are working with a smaller set of data. After the SuperScan, all
detected volumes are displayed. When you change the settings in the filter dialog box, you can display only selected types of
volumes.
To filter SuperScan results:
1. After running SuperScan, select the virtual folder with the name SuperScan [date time stamp]
2. Right-click the node. From the context menu choose Filter... The Filter Found Volumes dialog box appears

3. To select the types of file systems to display, in the File System area, clear the check box beside the types that you
do not want to display. Only the selected types of file systems data will be displayed
4. To display only those partitions within a specified size limit, in the Volume Size area, indicate the minimum and
maximum sized partitions in Megabytes. Only those partitions within the specified range will be displayed
5. To use basic filtering parameters, click Basic Filtering. To select displayed partitions based on partition status, in
the Basic Filtering [Volume Status] area, clear the check box next to each partition status number that you do
not want to display. Only the selected status ratings will be displayed
6. To use advanced filtering parameters, click Advanced Filtering and use the bottom section:
To restrict displayed results for found boot sector's attributes (file system-independent), in the Basic
Attributes area, select the check box beside all the types of data that you want to display
To restrict displayed results for NTFS-specific parameters, in the Specific to NTFS attributes area, select the
check box beside all the types of data that you want to display
To restrict displayed results for FAT-specific parameters, in the Specific to FAT attributes area, select the
check box beside all the types of data that you want to display
7. Click Filter to set up a filter for all volumes found by SuperScan
To remove a Filter, execute Remove Filter context menu command on the particular SuperScan node.
Searching SuperScan results to find files and folders
If, as a result of your SuperScan you find a large number of partitions, you may want to use a Search to help you locate
specific files or folders. You may apply Search for the particular volume, or for all volumes found. There are options in the
search dialog box that allow you to make the search go faster. For example, you may want to restrict the search so that only
deleted files and folders appear in the results, or restrict files by size. By choosing strict conditions, you may be able to locate a
specific file or folder faster.
Storing and loading SuperScan results

Depending on the size of the drive that you are scanning, it can take a long time to scan partitions. On large or damaged drives,
it can take hours. If you have to exit Active@ File Recovery for any reason, it would take a long time to scan the partition again.
So that you don't lose the information that you have scanned, you may save the SuperScan results to a file. When you open
Active@ File Recovery, opening the saved results file takes much less time.
If you decide to stop the SuperScan process, it is easy to continue scanning from the point that you stopped. After SuperScan
has stopped, you may save the SuperScan virtual folder results, exit and re-start the application, open SuperScan results and

resume SuperScan from the last point. To continue scanning, select the SuperScan virtual folder and click Resume button on
the right of the progress bar.
To save SuperScan results
1. In the Local System Devices list, select the SuperScan virtual folder and do one of the following:
Right-click the device node. From the context menu click Save Scan Results...
From the File menu, choose Save Scan Results...
2. In the Save Scan Results dialog box, type a path or browse to a folder where the scan results file is to be stored
3. Click Save
To open SuperScan results
1. From the File menu click Open Scan Results...

2. In the Open Scan Results dialog box, browse to the file where you saved the scan results file
3. Click Open
4. In the Matched Devices dialog box confirm the device name (HDD/USB name) to apply SuperScan results for.
Note
Several devices might have the same name, for example, similar disks usually used in RAID arrays. In this case the order they
appear in Matched Devices dialog matches the order devices appear in Local System Devices list. You may inspect your disks
in Local System Devices list to know for sure which device to choose.
Important
SuperScan results can be saved automatically. You can configure this option and storage path in General tab of
product Settings.

Use Last Chance recovery by file signatures
This recovery method is helpful when primary recovery methods (QuickScan and SuperScan) either havent detected your files
and folders, or hundreds of volumes are being detected and you cannot locate or recover your files from them.
This recovery method tries to detect all un-fragmented files based on their standard signatures. In most cases we will be able to
detect and properly recover the contents of lost files. However we wont be able to detect the file system attributes (eg. original
filename, creation date, modification date etc). Detected and recovered files will be grouped by file extension only, and will have
abstract file names. The File Organizing feature will help you to group your files into folders based on extended file attributes
(available for some file types). For example, songs may be grouped by artist and or album, and photo images may be grouped
by camera and the date the photo was taken.
To use Last Chance recovery method:
1. Launch Active@ File Recovery and click Last Chance toolbar button, or click Last Chance from Tools menu
2. Select the drives you wish to analyze, or de-select disks you are not interested in
3. Confirm file signatures to be analyzed and de-select file types you are not interested in recovering (this will speed up
the process significantly)
4. Click Start button and wait until the scan process completes
5. Review found by signatures files, Preview file content to make sure files are recoverable and it's what you need
6. If needed, re-organize found files in folders by specific attributes using File Organizer:

7. Select file groups or particular files to be recovered and click Recover toolbar button to recover them all at once

Search for Deleted Files and Folders
Search procedure can be helpful when you've completed QuickScan for the particular volumes and you are not able to locate
your files, or you cannot assume the location.
Advice
Before using any recovery software, including Active@ File Recovery, check the Recycle Bin to see if the deleted file or folder is
there. If it is, use the standard Windows Restore command to recover your data from there. If you cannot find the file or folder
you are looking for in the Recycle Bin, continue with search and recovery procedures.
To locate specific files and folders:
1. Launch Active@ File Recovery and select a volume that supposedly contains deleted files
2. Try direct listing: If you know exactly where the deleted files or folders are located, you can use the volume
scan procedure. After the drive has been scanned, manually navigate to the folder path the same way as you would
in Windows Explorer. If you cannot find the file or folder, open a tree node named !Lost & Found! If the parent
folder of the deleted file has been deleted as well, it is very likely the deleted item will be placed in this virtual folder.
If you are still unable to locate your data, proceed to the next step
3. Try filtering: For the particular volume (or even folder) you can setup a filter to display deleted only or existing only
files and folders:
To display only deleted files, right-click the volume and choose Deleted Files/Folders only from the context
menu. You can also click View Deleted Files/Folders only toolbar button in Filter section
To display only existing files, right-click the volume and choose Existing Files/Folders only from the context
menu. You can also click View Existing Files/Folders only toolbar button in Filter section
To clear the filter, right-click the volume and choose All Files/Folders from the context menu. You can also
click View All Files/Folders toolbar button in Filter section

4. Try Search mode: If you are not certain where the deleted file or folder was located before it was deleted, select a
drive or folder and click Search on the toolbar, or right-click the drive or folder and choose Search in
the context menu, or select a volume and press Ctrl+F. Do the following in the Search dialog box:
a. To find a file by name, enter the file name in the Find what field. Search will look for files that match
the name. You may enter part of the file name and use an asterisk (*) to represent the rest of the name.
Regular expressions are supported (RegExp)
b. To search by file type, choose a file type from the File type drop-down list
c. To exclude existing files and folders from the search results, mark the Deleted option
d. To exclude deleted files and folders from the search results, mark Non-deleted option
e. To use case sensitive search, clear the Case insensitive search check box
f. To search for a file based on a date, select the Created, Modified or Accessed [Deleted] check boxes
and enter a From and To date range
g. To search for a file based on the size of the file, select the Size check box and enter a From and To size
range
h. Click Search to start the Search process
i. After the Search is complete, examine the Search virtual folder. This is a flat list of all items satisfying
your criteria. You can sort Search results on any column (name, size, date, ID...), check properties of
items, preview and recover files and folders.
5. Try SuperScan: If no files were found, use the SuperScan to thoroughly scan the HDD/SSD/USB surface to
reconstruct all possible data entries. This is relatively slow process, however it brings maximum results:
SuperScan detects and reconstructs many volumes presumably existed on scanned disk area. It can
detect FAT/FAT32/exFAT, NTFS, ReFS, Apple HFS+, Linux Ext2/Ext3/Ext4/BtrFS, Unix UFS/XFS/JFS file
systems. Inspect these volumes to evaluate a full data set being recovered.

SuperScan inspects existing volumes more deeply, for example, if you formatted the volume, QuickScan
displays no files on it, however SuperScan most likely will detect formatted data structures and will
reconstruct previous data tree.
SuperScan has an option of detecting deleted files by their signatures. More than 50 predefined file
signatures have been implemented internally (MP3, JPG, DOC, ZIP, etc..) and there is an option to
create and load custom signatures from template files.
If you have completed of all the steps listed above and your files and folders still cannot be found, it is likely that the drive space
formerly occupied by your files has been completely overwritten with other data. If this is the case, there are no recovery tools
that can help you. This can happen when a lot of writing operations occur on the drive, for example during a software
installation. As well, Windows operating system will sometimes create temporary files for different processes. If the process
involves a lot of data and many temporary files are written, your deleted files may have been destroyed.
Important
When you are using a search pattern in Search, it is the same pattern recognized when searching in Microsoft Windows. The
asterisk symbol (*) in the pattern means, that at this place can be zero, or any number of any symbols.
Examples:
* - All files on the drive or in the folder

*.TXT - All files with "TXT" extension
My*.* - All files starting with "My"
MyFile.txt - Search for the file named "MyFile.txt"
Note
You can distinguish deleted files and folders from existing files and folders by the icons:
Blue or yellow icons show existing file or folder
Grey icons show deleted file or folder

Preview File Contents (Recovery Status Check)
In order to recover files or folders, you must scan the drive or partition and then search for damaged or deleted files or folders.
If you have found some damaged or deleted files and you are not sure whether or not a file is safe for recovery or you are not
sure whether or not the file data has been overwritten on the drive, you may preview the contents of files with this feature.
For Preview mode to be available, File Preview component needs to be selected when you are installing the software. If File
Preview has not been installed, Preview command will be greyed out and inaccessible.
If the file data has been overwritten on the drive, it is not likely that the file can be previewed. If this is the case, you will see a
warning message, and file will be previewed in Hex format. If you plan to purchase the commercial version of Active@ File
Recovery, you may want to preview file contents to help you determine whether or not the contents are valuable using the
DEMO version of the software. If you can preview file contents, it is likely that you can recover the file.
Preview file contents using the built-in preview module works with the following image files: *.bmp, *.wbmp, *.dib, *.gif,
*.jpg, *.jpeg, *.pcx, *.ico, *.tif, *.tiff, *.png, *.wmf.
Other document types can be previewed using an external viewer like Microsoft Word or using the built-in Hex/Text viewer. If
you want to preview a file named MyDoc.DOC you must have an application installed that is able to open *.DOC files. The file
will be rendered and previewed using this application. If you do NOT have an application installed that is able to open *.DOC
files, the file will be previewed in the default built-in Hex/Text viewer.
For example, if you have Microsoft Office installed, most likely you will be able to preview office document types: *.doc,
*.docx, *.xls, *.xlsx, *.ppt, *.pptx, *.vsd, *.mpp, *.rpt.
Important
Avoid previewing large files! In order to preview a file's contents, the file needs to be recovered and placed in temporary
storage. The built-in or external preview utility reads this temporary file. If you have enough RAM, the temporary file is kept in
volatile memory. If you do not have enough RAM, a temporary file could be written onto the drive that contains damaged or
deleted files and there is a chance that you may overwrite your original deleted data.
To preview file contents and check recovery status:
1. In Active@ File Recovery, search for deleted files and folders and select the file.
2. To launch Preview module, use one of the following methods:
Right-click the file, and choose Preview from the context menu
Double-click the file
Press Enter or Ctrl+P key combination
3. A Preview window appears with the first page of your document.
Note
You cannot preview encrypted files and files having size more than 10MB.

Restore a Deleted File
You can distinguish deleted files from existing files by the icons:
Blue icons show existing files
Grey icons show deleted files
Important
For the safety reasons, Active@ File Recovery warns you if you are trying to write the restored file back onto the same drive.
When you write a file to the same drive that contains deleted or damaged data, you may overwrite data that belongs to other
deleted files or folders, or you may overwrite part of the same file that you are trying to recover. Always restore files to another
physical HDD, external USB, removable or network drive.
To restore a deleted file:
1. In Active@ File Recovery, search for deleted files and select the file (or group of files) to be recovered
2. Launch Recovery Options dialog using one of the following methods:
Click Recover button on the toolbar:
Right-click the file, and then choose Recover from the context menu
Press Ctrl+R key combination
3. To give the file a name, you may use the file name that appears in the Name field or you may type a different name.
This option is only available if selected the only one folder
4. To recover the file to a specified location, in the Recover to field, you may type a different path or click the ellipsis
button (...) and browse to a recovery folder location
5. If you selected several files, you have an option of filtering them for the recovery process: to recover All selected
files, Deleted only or Existing only files
6. You have an option of recovering named streams attached to a file on NTFS volume. This includes, for example, Music
ratings and album info, Document Author and properties, and so on... These streams will only be recovered and
attached to a file when recovering target is an NTFS volume (FAT/exFAT do not support named streams)
7. When you selected and want to recover files detected by their signatures, option Organize by file meta-data is
available. If you turn on this option all selected files will be sorted and placed to subdirectories by Title then by

Creation Date. This allows, for example, organizing pictures by Camera Model, and inside the particular Camera
Model organize pictures by the date when these pictures have been taken. If this option is turned off - all selected
files will be recovered as a flat list of files located in one folder
8. Option Browse output folder after recovery will open Windows Explorer and display the recovered file after
recovery process is complete
9. Extended recovery configuration options are available in Settings:
Naming options: whether to use original file names, or to generate unique file names for each file being
recovered
Conflict resolution: what to do when file being recovered already exists in the target folder (name duplicate
detected)
10. Click Recover
After the recovery process is complete, make sure that the results are correct by verifying the contents of files. In some cases, a
file cannot be reliably restored because its contents or a part of it has been overwritten.

Restore a Deleted Folder
You can distinguish deleted folders from existing folders by the icons:
Yellow icons show existing folders
Grey icons show deleted folders
Important
For the safety reasons, Active@ File Recovery warns you if you are trying to write the restored file back onto the same drive.
When you write a file to the same drive that contains deleted or damaged data, you may overwrite data that belongs to other
deleted files or folders, or you may overwrite part of the same file that you are trying to recover. Always restore files to another
physical HDD, external USB, removable or network drive.
To restore a deleted folder:
1. In Active@ File Recovery, search for deleted data and select the folder (or group of folders) to be recovered
2. Launch Recovery Options dialog using one of the following methods:
Click Recover button on the toolbar:
Right-click the file, and then choose Recover from the context menu
Press Ctrl+R key combination
3. To give a name, you may use the name that appears in the Name field or you may type a different name. This option
is only available if selected the only one folder
4. To recover the to a specified location, in the Recover to field, you may type a different path or click the ellipsis button
(...) and browse to a recovery folder location
5. If you selected several folders, you have an option of filtering them for the recovery process: to recover All selected
folders, Deleted only or Existing only folders
6. You have an option of recovering named streams attached to a file on NTFS volume. This includes, for example, Music
ratings and album info, Document Author and properties, and so on... These streams will only be recovered and
attached to a file when recovering target is an NTFS volume (FAT/exFAT do not support named streams)
7. When you selected and want to recover files detected by their signatures, option Organize by file meta-data is
available. If you turn on this option all selected files will be sorted and placed to subdirectories using specified
column order and folder depth. For example, with default options MP3 music files will be displayed and recovered by
Artist then by Album, and files will be named using Title attribute. This allows, for example, organizing pictures by

Camera Model, and inside the particular Camera Model organize pictures by the date when these pictures have been
taken. If this option is turned off - all selected files will be recovered as a flat list of files located in one folder
8. Option Browse output folder after recovery will open Windows Explorer and display the recovered items after
recovery process is complete
9. Extended recovery configuration options are available in Settings:
Naming options: whether to use original file names, or to generate unique file names for each file being
recovered
Conflict resolution: what to do when file being recovered already exists in the target folder (name duplicate
detected)
10. Click Recover
After the recovery process is complete, make sure that the results are correct by verifying the contents of files. In some cases, a
file cannot be reliably restored because its contents or a part of it has been overwritten.

Virtually Reassemble Deleted or Damaged RAID
There are many reasons for a Redundant Array of Independent Disks (RAID) system to fail (RAID controller failures, software
RAID emulator errors, etc.). Active@ File Recovery provides an easy way to assemble array disks together and make damaged
or deleted data accessible.
You can combine together a disk that was previously used as a part of a RAID system in a temporal (virtual) disk array. With
this virtual configuration, you are able to perform all drive file recovery manipulations as though it is regular drive. You can even
to create a Disk Image for the whole RAID and store it to the safe location.
It is important that you specify the parameters of the RAID system that you know existed before the fault so that you can
virtually reassemble the same system.
It is also important to list the disks in the correct order when making a virtual disk array. In most cases, the correct order is
unknown. The only way to discover the correct order is to try all available combinations until you reach the one that works. If
you are dealing with only two disks, it is simple. You have only two ways to arrange the order. If there are three disks, you must
try a maximum of six combinations. If there are four disks, 24 combinations, and so on...
Each time you try a combination, write down the order you are trying, click Re-Create and check the results by trying to access
and scan the newly-created virtual RAID that is added to the list of Local System Devices. If you don't see your data or if
there was an error during virtual array creation, mark this one as a failure and try another order of disks in array.
To create a Virtual Disk Array (RAID):
1. To open RAID Reassembly dialog, do the following:
In the Tools menu, choose Virtual Disk Array (RAID)...

2. To choose a supported RAID type, in the top drop-down list box, choose one of the following:
Stripe Array (RAID-0) - Data located in stripes (blocks of size 32KB, 64KB, 128KB, etc.) distributed between
two or more drives
Mirror Array (RAID-1) - Data on two disks is identical - provides complete data duplication (or mirroring)
RAID-5 Array - Data located in stripes distributed between two or more drives with parity control
Span Array - Data located contiguously on one disk then on another disk, and so on...
3. To select disks from a list to create a virtual disk array:
a. In the Available Disks list, select a device (or disk image)
b. To add it to the Selected Disks list, click Add
c. Repeat steps a. and b. for every disk in the original array. If one of the disks is physically damaged and
not accessible, and if you have selected RAID-0 or RAID-5 in step 2, from the Available Disks list
add Damaged Device instead of the named damaged disk
d. To change the order of disks in the Selected Disks list, select a disk name and click Up or Down to
change its position in the list
4. To indicate the size of the stripe block, in the Options area, type the size of the block in kilobytes in the Stripe Block
(RAID0 and RAID5) field. This is applicable only to RAID-0 and RAID-5 arrays. Standard values are 32Kb, 64Kb,
128Kb, 256Kb. If you are not sure, try each size until you get the correct one
5. To indicate the offset and the size of the device, measured in sectors (each sector is 512 bytes), in the Disk Area to
Use in RAID (Sectors) area, type the values in the Device Offset and Size fields. In most cases, the default
values are acceptable. Some RAID controllers use only part of the disk surface. For example HighPoint 370 uses the
first 100 sectors on the first drive for its own system information. In this case you would specify the offset as 100
sectors
6. Click Re-Create to start Virtual Disk Array reassembly process

7. In the Local System Devices list, a new Virtual Disk Array device node appears. You may treat this new node and its
contents the same way that you treat other device nodes in the list.
You may follow the standard steps to scan the Virtual Disk Array node, then search for files and folders to be recovered. You
may also create a Disk Image of the whole Virtual Disk Array to work with it later on.
Note
When dealing with Span Arrays, you may get the size of a Damaged Disk a couple of ways:
Go to the hard drive manufacturer's web site and look for the model.
Look for the device geometry label on the top of the physical drive. If you find it (it is not always there) you can multiply
the parameters C*H*S (Cylinders * Heads *Sectors per Track) to get the number of sectors. For example, Samsung
SW0212A has the following: CYL 4092, HD 16, SEC 63, 2.1GB. Multiply 4,092*16*63 to get 4,124,736 sectors. To
calculate the disk size, multiply 4,124,736*512 = 2,111,864,832bytes = 2.1GB. We just confirmed the size 2.1GB. The
size is marked on drive label and that proves that our calculations are correct.
Important
When dealing with RAID5 Arrays, if the most frequently used Left Asynchronous type does not work for you, you may try some
several different types of building array:
Left Asynchronous (the most frequently used in hardware RAIDs)
Left Synchronous (used in the most software RAIDs, based on LDM)
Right Synchronous

Right Asynchronous
You may consult your RAID controller manufacturer to determine the proper RAID5 type being used in hardware.

Open and work with Disk Image
A Disk Image is a mirror copy of your entire logical drive or physical device stored as file or set of files. If you have enough
space on another drive, it may be a good idea to create a Disk Image for a drive containing deleted files that you want to
recover.
Active@ File Recovery can open:
RAW and RAW-Compressed disk images (Active@ Image format: *.DIM)
RAW disk images created by third party software (WinHex, etc...)
Disk Images (RAW format) composed from several chunks
VMWARE (*.vmdk) and VirtualPC (*.vhd) Disk Images
To open a Disk Image:
1. Start Active@ File Recovery.

2. To invoke the Open Image dialog, do one of the following:
Press Ctrl+O key combination
In the File menu, choose Open Image...
3. Use drop-down list-box at bottom to specify disk image type: Active@ Image, Any RAW image, VMWare or VirtualPC
Disk image
4. Locate and select disk image file you want to open. Click Open
5. Confirm disk Image Type, Bytes per sector and chunks, specified in configuration file:
6. If there are no configuration file, you can add chunks and change their order manually, using buttons at the right side
7. Click OK to complete configuration and read disk image structures.
The opened disk image appears in the Local System Devices list.

You may treat the opened Disk Image node and its content the same way that you treat other device nodes in the list. You may
follow the same steps to scan the volume, search for files and folders to be recovered. Or you can use opened Disk Images as
devices for creating RAID Virtual Arrays.
Note
If you've created raw disk image using other third-party utilities (like copying sectors from WinHex) you are still able to open it!
Just choose Any Raw Image disk image type in the Open File standard dialog and you will see all files on the disk. Select the
required one.

Create a Disk Image
A Disk Image is a mirror copy of your entire logical drive (volume) or physical device (HDD, USB, ...) stored as set of files. It
may be a good idea to create a Disk Image for a drive containing deleted files that you want to recover, if you have enough
space on another drive.
You might ask, "Why should I create a Disk Image on a drive that holds my deleted files?"
Here is the answer: If you do something wrong while attempting to recover the files (for example, recovering files onto the
same drive could destroy their contents), you will be able to recover these deleted files and folders from the Disk Image that
you have wisely created.
Disk Image (Active@ Image format) consists of configuration file (with an extension .DIM) and set of file chunks having
extensions .000, .001, .002 ... By default Active@ File Recovery tries to create one file (chunk) for the whole volume/device,
however, in case if target location is FAT, it may not be possible due to file system limitations. In this particular case disk image
splitted to several chunks and each file has a size of 2Gb. Chunks content can be RAW or RAW-Compressed, depending on
settings.
To create a Disk Image:
1. Start Active@ File Recovery and select a drive (volume) or physical device that you want to create image for
2. To open the Create Image dialog box, do one of the following:
Choose Create Image... from the File menu
Press Ctrl+I key combination
Right-click the device and choose Create Image on the context menu
3. Select another physical device or another logical drive to store Disk Image files
4. Browse to the folder where you want to save the Disk Image
5. To give the Disk Image file a different name, type a new name in the File Name field
6. Click Save to start Disk Image creation
7. Watch the progress and wait while drive's contents are copied to the new location. You may cancel the process of
image creation anytime by clicking Stop
To create Disk Image default options being used.
To change Disk Imaging default options:
1. Click Settings toolbar button, or choose Settings... from View menu, or press F2
2. Click Images tab

3. Change default storage path, locking and error options, compression and chunks splitting options:
Important
You must always create a Disk Image on a drive other than the source drive. Do not try to save a Disk Image of a drive onto
itself.

Search for File Signatures and Define Custom
Signatures
In case if recovery software is unable to detect deleted files after QuickScan or SuperScan (for example, when directory area
keeping file headers is wiped out or overwritten by other data), the only chance to recover files is to search for file signatures.
In this case un-fragmented files can still be detected and recovered.
Active@ File Recovery comes with more than hundred predefined (internally programmed, very fast) standard file signatures to
be analyzed while SuperScan (MS Office Documents, Photo Camera Image formats, ZIP/RAR Archives, Music & Video MP3/MP4,
etc..). For expert users there is advanced programming language which allows to define custom file signatures for Active@ File
Recovery to search for specific data formats.
Active@ File Recovery offers advanced tools to define user's templates for signatures to be analyzed. Signatures can be
described using extended definition language RegExp (Regular Expressions).
To search for standard file signatures:

1. Start Active@ File Recovery and choose a disk or volume to be inspected (place a cursor on it)
2. Launch SuperScan dialog box and define SuperScan options
3. Select All Signatures, Documents & Photos only or Select Signatures to be recognized:
4. If you selected Select Signatures option, verify and select particular signatures to be processed and recognized:
5.
6. Click Scan button and wait until some files have been recognized
7. Inspect specific groups in Signatures folder for files being detected
8. Preview and recover files (if detected) from specified groups
To preview, organize and recover files detected by signatures:

1. Select SuperScan node in the tree view on the left and Signature Files tab in the list view on the right
2. Expand general groups (Music, Documents) and specific sub-types (MP3, XLS,..) to inspect what is detected:

3. If file detected by signatures has some extended attributes, like AUTHOR, CREATED, TITLE, etc., these attributes
will be displayed on the right. By default the only 5 first detected file attributes being displayed. To display more
attributes, use Show Attributes drop down list
4. By default files are not sorted and displayed in the order of detection. To group files by attributes, click the column you
want to sort on. If Subsequent Column Sorting option is turned ON, files are grouped & sorted on all columns
followed the column you clicked. This could be convenient, for example, if you want to group music by Artist and then
by Album
5. If you want to hide some attributes or change display order, click Organizer button on the toolbar to open Signature
Files Organizer. Dialog appears and you can change the attribute for the particular file type (MP3, XLS, ) to be
displayed in the particular column on the screen. For example, default column order for music is Artist, Album, Title,
Genre, Year,... To group MP3 first by Year, then by Artist, then by Album, change column order using arrows at
the right side this way:
and you will see:

6. To recover files detected by Signatures, select the particular file or group of files, or even all signature files and click
Recover button. On Recovery Options dialog use Organize by file meta-data option to group files in folders
based on attributes (meta-data):
7. Use Attribute-based folder depth parameter to organize recovered files in a specified number of sub-folders. For
example, for the MP3 files default columns are Artist, Album, Title and default folder depth is 2. When you recover
MP3s using default parameters, your music files will be organized first by Artist, then by Album, so all album songs
will be in one folder. If you reorganize columns display like in example above (Year, Artist, Album,) and specify
folder depth 3, after recovery youll have music grouped in folders first by Year, then by Artist, then by Album.
Custom File Signatures

Sometimes advanced users need to detect more specific file formats, not being described in standard set of file signatures.
Active@ File Recovery offers advanced tools to define user's templates for signatures to be analyzed. Signatures can be
described using extended definition language (including scripting and calculation capabilities) which also complies with RegExp
(Regular Expressions). See language definition and syntax below.
To create and use a custom file signatures:
1. Create a text file containing one or multiple signatures definition (using syntax and examples below)
2. Launch Active@ File Recovery, select disk or volume to be inspected, and click SuperScan button
3. In SuperScan options, File types to be recognized based on signatures area, choose Signatures Recognition
tab
4. Load created text file contents into Recognized Signatures tree:
o Click Load Custom Signatures button
o Select text file containing signatures definition (load included example Custom_Signatures.txt, or create a
new one)
o Find custom signatures in Signatures Tree and make sure that they are selected

5. Click Scan button to execute SuperScan
6. Inspect specific groups in Signatures Files panel for files being detected
7. Preview and recover files (if detected) from specified groups
Signatures definition language and examples:
; ===========================================================================================================
; Signature Templates Usage
; ===========================================================================================================
; Empty lines and lines starting with semicolon are ignored
; Sections order and lines order in sections are not important
; Letter case is not important (excepting RegExp fields)
; -----------------------------------------------------------------------------------------------------------
; Section TEMPLATES - required and contains fields numbering from one
; - TEMPLATE### - points to the section where signature template is described (numbered from one)
;
; -----------------------------------------------------------------------------------------------------------
; Section Template Header - required and contains fields:
; - BEGIN - required. Points to the section describing begin of the signature file
; - FOOTER - non required. Points to the section describing end of the signature file
; - MAX_SIZE - non required. Maximum file size to force file-end, if no file-end signature is detected. By
default it is 64Kb.
; - GROUP - non required. If missed - template goes to User Defined templates group by default
; - DESCRIPTION - non required. This is a descriptive name of user template being displayed on a screen
; - EXTENSION - non required. This is a file extension to be assigned and displayed
; - SCRIPT - non required. Refers to the section where size of the file being calculated
; ------------------------------------------------------------------------------------------------ -----------
; Note: If field SCRIPT is present, then field FOOTER is ignored
;
; -----------------------------------------------------------------------------------------------------------
; Section describing file beginning (required), contains fields of the same type:
;
; <signature> = <offset_start> | <offset_end>
;
; signature - expression (regular or RegExp-compatible). Expression max length is 1024 bytes.
; offset_start - acceptable minimal signature offset from the beginning of the file
; offset_end - acceptable maximum signature offset from the beginning of the file
;
; If there are several fields listed in signature beginning, logical AND operation applied to confirm file
start.
;
;------------------------------------------------------------------------------------------------------------
; Section calculating file size (not required), contains operators of four types:
; <result> = <command> (<argument>, <argument>)
; <result> = <argument>
; IF (<argument> <condition> <argument>) GOTO <label>

; GOTO <label>
;
; <commands> : READ, ENDIAN, SUM, SUB, MUL, DIV, SHR, SHL, AND, OR and XOR
; Most of commands are the same as in assembler programming language, except:
; READ - first argument - data type (size) to be read, second - offset from the beginning of the file
; ENDIAN - first argument - data type (size), second - expression, which byte order will be swapped
; First argument for commands READ and ENDIAN must be one of reserved data types: BYTE, WORD, DWORD, QWORD
; <argument> : can be either a named variable or a constant
; <result> : can be the only named variable
; <condition>: can be one of : < <= == >= > != (meaning is the same as in C++)
; <label> : consists of label name followed by colon and it can precede any operator
;
; Label named EXIT has been reserved and instructs to complete the calculations
; Named variable SIZE has been reserved and keeps the file size
; Constants can be in Decimal form, Binary (followed by 'b'), Octal ('o'), and Hexadecimal ('h') or can be a text
string
;
; -----------------------------------------------------------------------------------------------------------
; Section describing file end (not required), contains fields of the same type:
;
; <signature> [= <bytes_to_append>]
;
; signature - expression (regular or RegExp-compatible). Expression max length is 1024 bytes.
; bytes_to_append - not required. How many bytes to append to the file after the signature is found
;
; If there are several fields listed in signature, logical OR operation applied to define file end.
; ===========================================================================================================
; Examples
; ===========================================================================================================
[TEMPLATES]
TEMPLATE1 = PRIMITIVE_HTML
TEMPLATE2 = PRIMITIVE_JPG
TEMPLATE3 = QBW_HEADER
TEMPLATE4 = CHM_HEADER
TEMPLATE5 = SWF_HEADER
TEMPLATE6 = PST_HEADER
TEMPLATE7 = MRW_HEADER
TEMPLATE8 = MID_HEADER
TEMPLATE9 = CAB_HEADER
TEMPLATE10 = BMP_HEADER
TEMPLATE11 = DJV_HEADER
[PRIMITIVE_HTML]
DESCRIPTION = Primitive HTML Signature
EXTENSION = html
BEGIN=HTML_BEGIN
FOOTER=HTML_FOOTER
MAX_SIZE = 655360
[HTML_BEGIN]
<html = 0 | 512
<head = 0 | 1024
[HTML_FOOTER]
</html> = 2
[PRIMITIVE_JPG]
BEGIN=BEGIN.TEST.JPG
GROUP = Images and Camera RAW files
DESCRIPTION = Primitive JPG files
FOOTER=FOOTER-.TEST.JPG
EXTENSION = test.jpg
MAX_SIZE = 3221225472
[BEGIN.TEST.JPG]
\xFF\xD8\xFF = 0 | 0
[FOOTER-.TEST.JPG]
\xFF\xD9
[DJV_HEADER]
DESCRIPTION=DjVu Document
EXTENSION=djvu
BEGIN=DJV_BEGIN
SCRIPT=DJV_SCRIPT
[DJV_BEGIN]
AT&TFORM=0|0
[DJV_SCRIPT]
size = read(dword, 8)

size = endian(dword, size)
size = sum(size, 12)
[QBW_HEADER]
DESCRIPTION=QuickBooks Document
EXTENSION=qbw
BEGIN=QBW_BEGIN
SCRIPT=QBW_SCRIPT
[QBW_BEGIN]
MAUI=96|96
[QBW_SCRIPT]
data = read(dword, 36)
temp = read(dword, 52)
if (temp <= data) goto exit
size = sum(temp, 1)
size = shl(size, 10)
[CHM_HEADER]
DESCRIPTION=Microsoft CHM Help
EXTENSION=chm
BEGIN=CHM_BEGIN
SCRIPT=CHM_SCRIPT
[CHM_BEGIN]
ITSF=0|0
[CHM_SCRIPT]
version = read(dword, 4)
if (version == 0) goto exit
header = read(dword, 8)
if (header <= 1Ch) goto exit
temp = read(qword, header)
if (temp != 1FEh) goto exit
temp = sum(header, 8)
size = read(qword, temp)
temp = sum(header, 10h)
if (size > temp) goto exit
size = 0
[SWF_HEADER]
DESCRIPTION=Adobe Flash SWF
EXTENSION=swf
BEGIN=SWF_BEGIN
SCRIPT=SWF_SCRIPT
[SWF_BEGIN]
FWS=0|0
[SWF_SCRIPT]
data = read(byte, 3)
if (data <= 10h) goto exit
if (size <= 8) goto exit
size = 0
[PST_HEADER]
DESCRIPTION=Outlook Archive
EXTENSION=pst
BEGIN=PST_BEGIN
SCRIPT=PST_SCRIPT
[PST_BEGIN]
!BDN=0|0
[PST_SCRIPT]
data = read(byte, 10)
if (data == 0Eh) goto valid
if (data != 17h) goto exit
goto exit
valid:
[MRW_HEADER]
DESCRIPTION=Minolta Camera Images
EXTENSION=mrw
BEGIN=MRW_BEGIN
SCRIPT=MRW_SCRIPT
[MRW_BEGIN]
\x00MRM=0|0

[MRW_SCRIPT]
data = read(dword, 4)
if (data == 0) goto exit
width = read(word, 24)
if (width == 0) goto exit
width = endian(word, width)
height = read(word, 26)
if (height == 0) goto exit
height = endian(word, height)
pixel = read(byte, 32)
if (pixel == 0) goto exit
pixel = mul(pixel, width)
pixel = mul(pixel, height)
pixel = div(pixel, 8)
size = endian(dword, data)
size = sum(size, pixel)
size = sum(size, 8)
[MID_HEADER]
DESCRIPTION=MIDI Audio
EXTENSION=mid
BEGIN=MID_BEGIN
SCRIPT=MID_SCRIPT
[MID_BEGIN]
MThd=0|0
[MID_SCRIPT]
next:
temp = read(dword, size)
if (temp == "MThd") goto valid
if (temp != "MTrk") goto exit
valid:
size = sum(size, 4)
temp = read(dword, size)
size = sum(size, 4)
temp = endian(dword, temp)
size = sum(size, temp)
goto next
[CAB_HEADER]
DESCRIPTION=Microsoft Compressed Archive CAB
EXTENSION=cab
BEGIN=CAB_BEGIN
SCRIPT=CAB_SCRIPT
[CAB_BEGIN]
MSCF=0|0
[CAB_SCRIPT]
version = read(word, 24)
if (version != 103h) goto exit
folders = read(word, 26)
folders = mul(folders, 8)
folders = sum(folders, 36)
files = read(word, 28)
files = mul(files, 16)
files = sum(files, folders)
if (temp < folders) goto exit
if (temp <= files) goto exit
flags = read(word, 30)
flags = and(flags, 4)
if (flags == 0) goto skip
flags = read(dword, 36)
if (flags != 20) goto skip
flags = read(dword, 44)
if (flags < temp) goto skip
size = flags
skip:
size = sum(temp, size)
[BMP_HEADER]
DESCRIPTION=Bitmap Images BMP
EXTENSION=bmp
BEGIN=BMP_BEGIN
SCRIPT=BMP_SCRIPT
[BMP_BEGIN]
BM=0|0
[BMP_SCRIPT]

width = read(dword, 12h)
if (width == 0) goto exit
height = read(dword, 16h)
if (height == 0) goto exit
pixel = read(word, 1ch)
if (pixel == 1) goto valid
if (pixel != 32) goto exit
valid:
pixel = mul(pixel, width)
pixel = mul(pixel, height)
pixel = div(pixel, 1000b)
rastr_size = read(dword, 22h)
if (rastr_size < pixel) goto exit
rastr_offset = read(dword, 0Ah)
if (rastr_offset < 38) goto exit
rastr_offset = sum(rastr_offset, rastr_size)
if (size >= rastr_offset) goto exit
size = 0
Important
Regular Expressions can be used while defining signature headers and footers. Please check RegExp syntax on a web, for
example here.

Inspect file headers and disk data (raw sectors)
with integrated Disk Editor (HexViewer)
Advanced users and IT professionals may require inspecting raw disk structures before actual recovery occurs - to evaluate
damage to the data and recovery chances. For these purposes Disk Editor (HexViewer) supplied as a separate application and is
accessible from recovery panel. Launch it from the context menu for the object to be inspected (hard disk, volume, file data):
For NTFS volumes MFT records inspection is available, Disk Editor is launched and MFT record template is applied for binary
data automatically:

Active@ Disk Editor
Active@ Disk Editor uses a simple, low-level disk viewer which displays information in binary and text modes at the same time.
You can use this view to analyze the contents of data storage structure elements such as:
Hard disk drives

SSD & USB Disks
Partitions & Volumes
Files
The Main Features:
Enhanced template view

Detailed MFT record information
Side-by-side Compare and Edit
Fields coloring with data in tooltips
Extensive exFAT support
Fast navigation points
Filling selection with a pattern
Unicode support
Quick Disk Info
Bookmarks
Data Inspector

Visit www.disk-editor.org and read Active@ Disk Editor documentation for more information.

Concept of File Signatures
If the data loss was caused due to a total file system failure, even the best file recovery programs can only recover the files by
signature. These programs use algorithms to determine the beginning, end and extension of a file without relying on data that
used to be contained in the file system. This works for only un-fragmented files (stored on the disk as a continuous set of file
data clusters). The file organizing functions allow you to create folders based on information contained inside the file and
outside the file system it is stored in, and move the file to these folders. This is useful when you detected and recovered files by
signatures, but recovered files have abstract names. The file organizer function is primarily used to open files of a chosen
extension, look at data contained within that file, create a folder structure that matches the data contained within the file and
copy the file to that folder. Its primary function is to organize and rename files after a catastrophic data loss.
Typically these files will be recovered into a single folder with names like file0001.jpg, or file1234.mp3. This may leave you
with several folders of recovered data bat the data within these folders will be difficult to use.
This is an example how NOT organized files detected by signatures could look like:
By using the file organizer, you can quickly and easily organize these files into folders that you can recognize and use your
recovered files. An example of the tremendous power of this data can be illustrated by the following scenario.
You had a total file system failure and had your files recovered by signature. You now have your data stored in folders
containing tens of thousands of JPG files, and another folder with all your MP3 files, and another folder with all your M4A files.
These files have names like file3124.MP3 or file1556.M4A. By using the file organizer, you could select your folder
containing all the MP3 files, choose your re-organizing options and then recover files to the specified folder's structure.
The MP3 files (or at least the ones that contain the relevant information) without re-organization could be arranged as follows:
D:\recovered\MP3\File3124.MP3
may be renamed to something like:
D:\MP3\year\Bandname\album\songname.mp3
You can use this functionality to organize files using information stored in the file itself.
This is an example how organized signature files could look like:

... and what you could see in Windows Explorer after recovery occurred:
In order to organize a file using the information stored within it, the file must obviously have the required information stored
within it, and the information must be stored according to the standards of the file specification.
Just because a file has an extension of JPG or MP3, does not ensure it contains the information the program needs to extract in
order to rename it. If this information is not present, the program will consider the file unrenamable. If the required option is
chosen, the unrenamable files will be moved to a specific folder chosen to house all the files that are unrenamable.
The following types of picture files can be organized using information contained within the file.
Picture files (with embodied tiff information):

3FR (Hasselblad 3F RAW Image)
ARW (Sony RAW image file)
CR2 (Canon Digital Camera Raw Image Format)
CRW (Canon Digital Camera Raw Image Format)
DCR (Kodak Digital Camera Raw Image File)
JPG (Joint Photographics Experts Group)
KDC (Kodak DC120 digital camera RAW image definition)
NEF (Nikon Digital SLR Camera Raw Image File)
ORF (Olympus Digital Camera Raw Image File)
RW2 (Panasonic Lumix RAW image file)
SR2 (Sony Digital Camera Raw Image File)
TIF/TIFF (Tagged Image File Format)
R3D (Red One)
Music files:
MP3 (MPEG Layer 3)
M4A (MPEG-4 Audio)
Microsoft Office documents (non-compressed and compressed):
DOC, DOCX, DOCM, DOTX, DOTM (Microsoft Word)
XLS, XLSX, XLSM, XLTX, XLTM (Microsoft Excel)
PPT, PPTX, POTX, POTM, PPTM (Microsoft Power Point)
VSD (Microsoft Visio)
MPP (Microsoft Project)
RPT (Microsoft Reports)

Recovery Tips
DO NOT WRITE ANYTHING ONTO THE DRIVE CONTAINING YOUR IMPORTANT DATA THAT YOU HAVE JUST
DELETED ACCIDENTALLY!
Even data recovery software installation could spoil your sensitive data. If the data is really important to you, and you do not
have another logical drive to install software to, take whole hard drive out of the computer and plug into another computer
where data recovery software has been already installed.
DO NOT SAVE ONTO THE SAME DRIVE DATA THAT YOU FOUND AND TRYING TO RECOVER!
While saving recovered data onto the same drive where sensitive data was located, you can intrude in process of recovering by
overwriting table records for this and other deleted entries. It's better to save data onto another logical, removable, network or
floppy drive.
CREATE DISK IMAGE IF YOU HAVE EXTRA HARD DRIVE, OR OTHER LOGICAL DRIVES ARE BIG ENOUGH!
Disk Image is a mirror of your logical drive that is stored in one file. This can be useful when you want to backup the contents of
the whole drive, and restore it or work with it later. Before you start recovering the deleted files, it may be a good idea to create
a Disk Image for this drive, if you have enough space at another drive. Why? Because if you do something wrong while
recovering the files (for example, recovering them onto the same drive could destroy their contents), you still will be able to
recover these deleted files and folders from the Disk Image that you have wisely created.

Frequently Asked Questions (FAQ)
I deleted a file. How long do I have before data recovery is no longer possible?
It is not possible to predict a time like this in hours or days. Microsoft Windows can overwrite a deleted file immediately if it
selects the same data clusters.
To maximize recovery chances try not to write anything onto the drive where a deleted file is located before you start using
recovery software.
How can I download the trial version of Active@ File Recovery utility?
You can do it from the www.file-recovery.net Web site. The trial version is a utility with full functionality of the final program.
The only limitation is the maximum size of the file being restored.
I found that I have deleted very important document. It was deleted BEFORE Active@ File Recovery was installed on my
computer. Is it possible to restore it
Yes, if the file has not already been written over (by some other files). If you have found that some important file is deleted,
download and install Active@ File Recovery and search for this file. It may be a good idea to avoid excessive disk activity on this
particular hard drive, not to make a lot of other file deletions, to avoid computer reboots, not to invoke large number of
programs concurrently (which would cause the increased OS Paging/Swapping activity), etc. - all of this might overwrite or
partially overwrite the deleted document and also will make finding a particular file more complicated. The more free hard drive
space you have on your computer, the greater the chances for a successful retrieval of deleted file contents. It is always a good
idea to extract and install Active@ File Recovery to some OTHER hard drive - that does not contain important deleted file(s).
Does Active@ File Recovery work under Windows 2000 / XP?

Yes, it does.
Does Active@ File Recovery support localized (e.g. French, Spanish) files names
Yes, provided the OS and file system support localized file names.
What is a Disk Image? Why is it needed?
Disk Image is a mirror of your logical drive that is stored in one file. This can be useful when you want to backup the contents of
the whole drive, and restore it or work with it later. Before you start recovering the deleted files, it may be a good idea to create
a Disk Image for this drive, if you have enough space at another drive. Why? Because if you do something wrong while
recovering the files (for example, recovering them onto the same drive could destroy their contents), you still will be able to
recover these deleted files and folders from the Disk Image that you have wisely created.

Glossary of Terms
boot record
See boot sector.
boot sector
The boot sector continues the process of loading the operating system into computer memory. It can be either the
MBR (see MBR, below) or the partition boot sector (see partition boot sector, below).
cluster
A group of disk sectors that contain file data. It is the smallest allocation unit for storing a file. For example, if the file
size is 100 bytes and the cluster size is 4096 bytes, the file system reserves one cluster, or 4096 bytes for file data.
data striping
Spreading blocks of data from files across multiple disk drives. Quicker read and write performance is a result.
device node
In the Local System Devices list, a physical device containing logical drives. The first physical device is named 80h.
disk mirroring
Identical data is written to two disks simultaneously. Used when access to data at all times is critical.
FAT
File Allocation Table. An area that contains the records of every other file data and directory in a FAT-formatted hard
disk drive. The operating system needs this information to access the files and define the data cluster's chain. There
are FAT32, FAT16 and FAT versions.
file
A collection of data with a file name and file attributes, like size.. Almost all information stored in a computer must be
in a file.
folder
An object that can contain a group of files. Folders are used to organize information. In DOS and UNIX, folders are
called directories or root areas.
HDD
Hard disk drive.
log file

A file that lists all events that have occurred. For example, Active@ File Recovery writes a log file entry for every
request made to the program and every event that happens as a result. You can see the log at the bottom of the main
screen.
logical drive
A partition is a logical drive because it does not affect the physical hard disk other than the defined space that it
occupies, yet it behaves like a separate disk drive.
MBR
The Master Boot Record (MBR) is a small program that is executed when the computer is first turned on. Typically, the
MBR can be found on the first sector of a disk. The MBR first reads the disk's partition table to determine which
partition is used to load the operating system. The MBR then transfers control to this partition's "boot sector" to
continue the process. Loading the operating system is called "booting" the computer.
MFT
Master File Table. A file that contains the records of every other file and directory in an NTFS-formatted hard disk
drive. The operating system needs this information to access the files.
NTFS
NT File System. NTFS was created to provide a more reliable operating system, compared to the FAT file system.
partition
A section of memory or hard disk isolated for a specific purpose. Each partition can behave like a separate disk drive.
partition boot sector
On NTFS or FAT file systems, the partition boot sector is a small program that is executed when the operating system
tries to access a particular partition. On personal computers, the Master Boot Record uses the partition boot sector on
the system partition to determine file system type, cluster size, etc. and to load the operating system kernel files.
Partition boot sector is the first sector of the partition.
partition status
SuperScan gives each partition a rating depending on how likely it is to recover data on the partition. A status rating of
1 is very bad. A status rating of 8 is excellent.
physical device
A piece of hardware that is attached to your computer by screws or wires. A hard disk drive is a physical device. It is
also referred to as a physical drive.
RAID-0
Provides data striping but no redundancy. This method provides quick performance but does not deliver fault
tolerance. If one drive fails then all data in the array is lost.
RAID-1
Writes identical data to two separate disks. Level 1 provides quick read performance and the same write performance
as single disks.

RAID-5
Provides data striping at the byte level and also stripe error correction information. This results in excellent
performance and good fault tolerance. Level 5 is one of the most popular implementations of RAID.
root area (and root folder)
An object that can contain a group of files in a FAT file system. In other words, a directory or folder. The root folder is
the top-level folder that has no parent and can have children. A logical drive can have only one root folder. Its name is
usually . (dot).
sector
The smallest unit that can be accessed on a disk. Tracks are concentric circles around the disk and the sectors are
segments within each circle.
span array
A series of dynamic drives linked together to make one contiguous spanned volume.
templates
File types are recognized by specific patterns that may serve as a reference for file recovery. When a file header is
damaged, the type of file may be determined by examining patterns in the damaged file and comparing these patterns
to known file type templates. This same pattern-matching process can be applied to deleted or damaged partitions.
Using FAT or NTFS templates, recovery software can assume that a particular sector is a FAT or NTFS boot sector
because parts of it match a known pattern.
volume
A fixed amount of storage on a hard disk. A physical device may contain a number of volumes. It is also possible for a
single volume to span a number of physical devices.

File Recovery

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

File Recovery

Uploaded by

Copyright:

Available Formats

Active@ File Recovery

1 Active@ File Recovery Guide

Active@ File Recovery Guide 2

3 Active@ File Recovery Guide

2. Clusters are labeled as 'unoccupied'. The data is not removed.

Welcome to Active@ File Recovery

Microsoft NTFS / ReFS / FAT / exFAT

Active@ File Recovery supports:

Left Asynchronous (the most frequently used in hardware RAIDs)

Active@ File Recovery Guide 4

Adobe Actobat Document (*.pdf)

Camera Raw Files

Canon Raw CIFF Image File (*.crw)

7-Zip File Archive (*.7z)

DjVu eBook Image File (*.djvu)

5 Active@ File Recovery Guide

File System Metadata

CDFS Disk Image File (*.iso)

FileMaker Pro 3.0 File (*.fp3)

Formatted Text Files

Compiled HTML Help File (*.chm)

Microsoft Office & OpenOffice Documents

Crystal Report (*.rpt)

Music & Audio Files

4X Technologies Audio File (*.4xa)

Active@ File Recovery Guide 6

Photos & Images

Bitmap Image File (*.bmp)

3G2 Multimedia File (*.3g2)

4X Technologies Media File (*.4xm)

7 Active@ File Recovery Guide

3D Studio Max Model File (*.max)

Recovery of fragmented files by signatures (MOV/MP4)

Full support for HiDPI monitors (large screen resolutions)

Improvements in XFS / Ext4 filesystems recovery

New security based on software registration and activation

Active@ File Recovery Guide 8

Improved display for HiDPI monitors and large resolution screens

Improved recovery of files just deleted, based on NTFS Log (Journal)

Minor improvements in user interface and in recovery algorithms

Added recovery of files from Linux BtrFS file system

Minor improvements in disk scan and recovery algorithms

Custom file signatures can be defined via powerful scripting language

Display of file meta-data (title, date) for files detected by signatures

9 Active@ File Recovery Guide

Added RAR archive signature to the internally supported Signatures List

New in version 9.5

New in version 9.0

New in version 8.0

New in version 7.3

Active@ File Recovery Guide 10

11 Active@ File Recovery Guide

There are two methods for scanning:

To run QuickScan, open Active@ File Recovery and do the following:

Click QuickScan button on the toolbar

Or, double-click the drive to start scanning

Or, press [ENTER] to start QuickScan using keyboard.

Active@ File Recovery Guide 12

Analyzing detected by QuickScan objects

Blue icon shows an existing file

Grey icon shows a deleted file

Yellow icon shows an existing folder

13 Active@ File Recovery Guide

2. To open the SuperScan Options dialog, do one of the following:

VMWARE (.vmdk) and VirtualPC (.vhd) Disk Images